# CVEs published 2015-03-31 20 CVEs were published on March 31, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2014-2027](https://cve.now/CVE-2014-2027.md): eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly exe (no CVSS) - [CVE-2014-2830](https://cve.now/CVE-2014-2830.md): Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam\_cifscreds, allows remote attackers to have (no CVSS) - [CVE-2014-9462](https://cve.now/CVE-2014-9462.md): The \_validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted reposito (no CVSS, mercurial) - [CVE-2014-9706](https://cve.now/CVE-2014-9706.md): The build\_index\_from\_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a (no CVSS, dulwich) - [CVE-2014-9707](https://cve.now/CVE-2014-9707.md): EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (no CVSS) - [CVE-2015-0838](https://cve.now/CVE-2015-0838.md): Buffer overflow in the C implementation of the apply\_delta function in \_pack.c in Dulwich before 0.9.9 allows remote attackers to execute ar (no CVSS, dulwich) - [CVE-2015-2684](https://cve.now/CVE-2015-2684.md): Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML mess (no CVSS) - [CVE-2015-2753](https://cve.now/CVE-2015-2753.md): FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafte (no CVSS) - [CVE-2015-2754](https://cve.now/CVE-2015-2754.md): FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a craft (no CVSS) - [CVE-2015-2776](https://cve.now/CVE-2015-2776.md): The parse\_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted share (no CVSS) - [CVE-2014-7876](https://cve.now/CVE-2014-7876.md): Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmwar (no CVSS) - [CVE-2015-0900](https://cve.now/CVE-2015-0900.md): Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote a (no CVSS) - [CVE-2015-0901](https://cve.now/CVE-2015-0901.md): Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitra (no CVSS) - [CVE-2015-2106](https://cve.now/CVE-2015-2106.md): Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers (no CVSS) - [CVE-2015-2108](https://cve.now/CVE-2015-2108.md): Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain s (no CVSS) - [CVE-2015-2109](https://cve.now/CVE-2015-2109.md): Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive informa (no CVSS) - [CVE-2014-9209](https://cve.now/CVE-2014-9209.md): Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and (no CVSS) - [CVE-2015-0984](https://cve.now/CVE-2015-0984.md): Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C (no CVSS) - [CVE-2015-0985](https://cve.now/CVE-2015-0985.md): Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authenticati (no CVSS) - [CVE-2014-9708](https://cve.now/CVE-2014-9708.md): Embedthis Appweb before 4.6.6 and 5.x before 5.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via a Ran (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-03-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.